From ac8bb32d3fb1908e8997a1234fdc628c9aed1c18 Mon Sep 17 00:00:00 2001
From: DJP <DJP>
Date: Tue, 17 Mar 2026 23:14:24 -0400
Subject: [PATCH] Fix bulk routes matched by :userId param

Moved /balances/bulk/* routes before /balances/:userId/* so Express
doesn't treat "bulk" as a userId and try to parse it as an ObjectId.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 routes/api.js | 52 +++++++++++++++++++++++++--------------------------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/routes/api.js b/routes/api.js
index 6454521..858cb49 100644
--- a/routes/api.js
+++ b/routes/api.js
@@ -45,6 +45,32 @@ router.get('/balances/search', async (req, res) => {
   }
 });
 
+router.post('/balances/bulk/add', async (req, res) => {
+  try {
+    const { amount } = req.body;
+    if (typeof amount !== 'number' || amount === 0) {
+      return res.status(400).json({ error: 'Invalid amount' });
+    }
+    const result = await balanceService.addToAll(req.db, amount);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+router.post('/balances/bulk/set', async (req, res) => {
+  try {
+    const { amount } = req.body;
+    if (typeof amount !== 'number' || amount < 0) {
+      return res.status(400).json({ error: 'Invalid amount' });
+    }
+    const result = await balanceService.setAll(req.db, amount);
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
 router.get('/balances/:userId', async (req, res) => {
   try {
     const balance = await balanceService.getUserBalance(req.db, req.params.userId);
@@ -83,30 +109,4 @@ router.post('/balances/:userId/add', async (req, res) => {
   }
 });
 
-router.post('/balances/bulk/add', async (req, res) => {
-  try {
-    const { amount } = req.body;
-    if (typeof amount !== 'number' || amount === 0) {
-      return res.status(400).json({ error: 'Invalid amount' });
-    }
-    const result = await balanceService.addToAll(req.db, amount);
-    res.json(result);
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-router.post('/balances/bulk/set', async (req, res) => {
-  try {
-    const { amount } = req.body;
-    if (typeof amount !== 'number' || amount < 0) {
-      return res.status(400).json({ error: 'Invalid amount' });
-    }
-    const result = await balanceService.setAll(req.db, amount);
-    res.json(result);
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
 module.exports = router;